<!DOCTYPE HTML>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /> 
    <title> - 天地维杰网</title>
    <meta name="keywords" content="系统架构,shutdown,不与天斗,Domino,博客,程序员,架构师,笔记,技术,分享,java,Redis">
    
    <meta property="og:title" content="">
    <meta property="og:site_name" content="天地维杰网">
    <meta property="og:image" content="/img/author.jpg"> 
    <meta name="title" content=" - 天地维杰网" />
    <meta name="description" content="天地维杰网 | 博客 | 软件 | 架构 | Java "> 
    <link rel="shortcut icon" href="http://www.shutdown.cn/img/favicon.ico" />
    <link rel="apple-touch-icon" href="http://www.shutdown.cn/img/apple-touch-icon.png" />
    <link rel="apple-touch-icon-precomposed" href="http://www.shutdown.cn/img/apple-touch-icon.png" />
    <link href="http://www.shutdown.cn/js/vendor/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />
    <link href="http://www.shutdown.cn/js/vendor/fancybox/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />
    <link href="http://www.shutdown.cn/css/main.css" rel="stylesheet" type="text/css" />
    <link href="http://www.shutdown.cn/css/syntax.css" rel="stylesheet" type="text/css" />
    <script type="text/javascript" id="hexo.configuration">
  var NexT = window.NexT || {};
  var CONFIG = {
    scheme: 'Pisces',
    sidebar: {"position":"left","display":"post"},
     fancybox: true, 
    motion: true
  };
</script>
<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7826003325059020" crossorigin="anonymous"></script>
</head>
<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">
<div class="container one-collumn sidebar-position-left page-home  ">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"> <div class="site-meta  custom-logo ">

  <div class="custom-logo-site-title">
    <a href="http://www.shutdown.cn"  class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <span class="site-title">天地维杰网</span>
      <span class="logo-line-after"><i></i></span>
    </a>
  </div>
  <p class="site-subtitle">人如秋鸿来有信，事若春梦了无痕</p>
</div>

<div class="site-nav-toggle">
  <button>
    <span class="btn-bar"></span>
    <span class="btn-bar"></span>
    <span class="btn-bar"></span>
  </button>
</div>

<nav class="site-nav">
    <ul id="menu" class="menu">
      
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />首页
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/redis/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-battery-full"></i> <br />Redis
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/java/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-coffee"></i> <br />java
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/linux/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-linux"></i> <br />linux
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/daily/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-bug"></i> <br />日常问题
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/spring/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-child"></i> <br />Spring和Springboot
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/mac/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-fire"></i> <br />Mac相关
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/middleware/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-gavel"></i> <br />中间件
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/jiagou/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-rocket"></i> <br />架构
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/python/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-ship"></i> <br />python
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/front/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-bolt"></i> <br />前端
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/jvm/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-balance-scale"></i> <br />jvm
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/c/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-battery-empty"></i> <br />c语言
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/categories/web3/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-web3"></i> <br />web3
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/post/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br />归档
          </a>
        </li>
      
        <li class="menu-item ">
          <a href="http://www.shutdown.cn/about/" rel="section">
              <i class="menu-item-icon fa fa-fw fa-user"></i> <br />关于
          </a>
        </li>
      
      <li class="menu-item menu-item-search">
        <a href="javascript:;" class="popup-trigger"> <i class="menu-item-icon fa fa-search fa-fw"></i> <br /> 搜索</a>
      </li>
    </ul>
    <div class="site-search">
      <div class="popup">
 <span class="search-icon fa fa-search"></span>
 <input type="text" id="local-search-input">
 <div id="local-search-result"></div>
 <span class="popup-btn-close">close</span>
</div>

    </div>
</nav>

 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            
<section id="posts" class="posts-expand">
  <article class="post post-type-normal " itemscope itemtype="http://schema.org/Article">
    <header class="post-header">
      <h1 class="post-title" itemprop="name headline">
        <a class="post-title-link" href="http://www.shutdown.cn/post/redis6.0%E6%96%B0%E7%89%B9%E6%80%A7-acl%E6%9D%83%E9%99%90%E6%8E%A7%E5%88%B6%E5%85%B6%E4%B8%80/" itemprop="url">
        
        </a>
      </h1>
      <div class="post-meta">
      <span class="post-time">
<span class="post-meta-item-icon">
    <i class="fa fa-calendar-o"></i>
</span>
<span class="post-meta-item-text">时间：</span>
<time itemprop="dateCreated" datetime="2016-03-22T13:04:35+08:00" content="0001-01-01">
    0001-01-01
</time>
</span> 
      
      
       <span>
&nbsp; | &nbsp;
<span class="post-meta-item-icon">
    <i class="fa fa-eye"></i>
</span>
<span class="post-meta-item-text">阅读：</span>
<span class="leancloud-visitors-count">5469 字 ~26分钟</span>
</span>
      </div>
    </header>
    <div class="post-body" itemprop="articleBody">
    

    

<blockquote>
<p>官方文档地址：<a href="https://redis.io/docs/manual/security/acl/">https://redis.io/docs/manual/security/acl/</a></p>
</blockquote>

<h1 id="acl">ACL</h1>

<p>Redis access control list</p>

<p>The Redis ACL, short for Access Control List, is the feature that allows certain connections to be limited in terms of the commands that can be executed and the keys that can be accessed. The way it works is that, after connecting, a client is required to provide a username and a valid password to authenticate. If authentication succeeded, the connection is associated with a given user and the limits the user has. Redis can be configured so that new connections are already authenticated with a &ldquo;default&rdquo; user (this is the default configuration). Configuring the default user has, as a side effect, the ability to provide only a specific subset of functionalities to connections that are not explicitly authenticated.</p>

<blockquote>
<p>Redis访问控制列表，简称ACL，是限定特定连接执行指定的命令和指定的键的功能。这个功能的工作方式是，连接后，客户端需要提供一个用户名和一个有效的密码来验证。如果验证成功，连接将被关联到一个验证通过的给定了权限限制的用户。Redis新连接默认授权给默认用户（默认配置）。配置默认用户权限会导致未明确身份的连接只能访问特定功能子集。</p>
</blockquote>

<p>In the default configuration, Redis 6 (the first version to have ACLs) works exactly like older versions of Redis. Every new connection is capable of calling every possible command and accessing every key, so the ACL feature is backward compatible with old clients and applications. Also the old way to configure a password, using the <strong>requirepass</strong> configuration directive, still works as expected. However, it now sets a password for the default user.</p>

<blockquote>
<p>默认配置方面，Redis6（有ACLs功能的第一版）运行和旧版Redis一样。每个新连接都可以调用所有可能的命令和访问所有键，因此ACL功能与旧版客户端和应用程序是兼容的。旧的方式配置密码，使用<strong>requirepass</strong>配置指令，仍然可以工作。但是，现在只给默认用户设置密码。</p>
</blockquote>

<p>The Redis <a href="https://redis.io/commands/auth"><code>AUTH</code></a> command was extended in Redis 6, so now it is possible to use it in the two-arguments form:</p>

<blockquote>
<p>Redis <code>AUTH</code> 命令在Redis6中扩展了，因此现在可以使用两个参数的形式：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">AUTH &lt;username&gt; &lt;password&gt;</code></pre></div>
<p>Here&rsquo;s an example of the old form:
&gt; 这里是旧的格式：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">AUTH &lt;password&gt;</code></pre></div>
<p>What happens is that the username used to authenticate is &ldquo;default&rdquo;, so just specifying the password implies that we want to authenticate against the default user. This provides backward compatibility.</p>

<blockquote>
<p>只提供密码的话我们默认使用&rdquo;default&rdquo; 这个默认用户进行鉴权。这提供了向后兼容性。</p>
</blockquote>

<h2 id="when-acls-are-useful">When ACLs are useful</h2>

<p>Before using ACLs, you may want to ask yourself what&rsquo;s the goal you want to accomplish by implementing this layer of protection. Normally there are two main goals that are well served by ACLs:</p>

<blockquote>
<p>使用ACLs之前，你应该考虑你使用ACLs的目的是什么？通常有两个主要目的：</p>
</blockquote>

<ol>
<li><p>You want to improve security by restricting the access to commands and keys, so that untrusted clients have no access and trusted clients have just the minimum access level to the database in order to perform the work needed. For instance, certain clients may just be able to execute read only commands.
&gt; 想要提升安全性，限定连接的命令和键的访问，这样不可信客户端没有访问，只有可信客户端可以访问数据库的最小访问级别，以便执行需要的工作。例如，某些客户端只能执行只读命令。</p></li>

<li><p>You want to improve operational safety, so that processes or humans accessing Redis are not allowed to damage the data or the configuration due to software errors or manual mistakes. For instance, there is no reason for a worker that fetches delayed jobs from Redis to be able to call the <a href="https://redis.io/commands/flushall"><code>FLUSHALL</code></a> command.
&gt; 想要提升操作安全度，防止进程或人工访问或配置导致软件错误的或者人工错误操作。不能谁都能调用<code>FLUSHALL</code>命令。</p></li>
</ol>

<p>Another typical usage of ACLs is related to managed Redis instances. Redis is often provided as a managed service both by internal company teams that handle the Redis infrastructure for the other internal customers they have, or is provided in a software-as-a-service setup by cloud providers. In both setups, we want to be sure that configuration commands are excluded for the customers.</p>

<blockquote>
<p>另一个常规ACLs应用场景是Redis服务器的管理。Redis通常由内部公司团队管理Redis的基础设施，或者是通过云服务提供商提供的服务。在这两种情况下，我们都希望确保配置命令不能被其他人调用到。</p>
</blockquote>

<h2 id="configure-acls-with-the-acl-command">Configure ACLs with the ACL command</h2>

<blockquote>
<p>配置ACLs</p>
</blockquote>

<p>ACLs are defined using a DSL (domain specific language) that describes what a given user is allowed to do. Such rules are always implemented from the first to the last, left-to-right, because sometimes the order of the rules is important to understand what the user is really able to do.
&gt; ACLs使用一种域特定的语言来描述了给定用户允许做的事情。这些规则总是由从第一个到最后一个，从左到右的方式来实现，因为有时候规则的顺序对于理解用户权限范围很重要。</p>

<p>By default there is a single user defined, called <em>default</em>. We can use the <a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a> command in order to check the currently active ACLs and verify what the configuration of a freshly started, defaults-configured Redis instance is:</p>

<blockquote>
<p>默认用户为*default*，我们可以使用<a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a>命令查看当前活跃的ACLs，并可以验证新启动的Redis实例的默认配置。</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL LIST
1) &#34;user default on nopass ~* &amp;* +@all&#34;</code></pre></div>
<p>The command above reports the list of users in the same format that is used in the Redis configuration files, by translating the current ACLs set for the users back into their description.</p>

<blockquote>
<p>上面的命令报告了当前的ACLs设置，通过将其转换为用户的描述来报告。</p>
</blockquote>

<p>The first two words in each line are &ldquo;user&rdquo; followed by the username. The next words are ACL rules that describe different things. We&rsquo;ll show how the rules work in detail, but for now it is enough to say that the default user is configured to be active (on), to require no password (nopass), to access every possible key (<code>~*</code>) and Pub/Sub channel (<code>&amp;*</code>), and be able to call every possible command (<code>+@all</code>).</p>

<blockquote>
<p>返回结果的前两个单词为 <code>user</code>和用户名。后面的单出是 ACL规则。可以看出配置的默认用户是活跃状态(<code>on</code>)，不需要密码 (<code>nopass</code>)，可以访问所有的键（<code>~*</code>）和Pub/Sub通道（<code>&amp;*</code>），并且可以调用所有的命令（<code>+@all</code>）。</p>
</blockquote>

<p>Also, in the special case of the default user, having the <em>nopass</em> rule means that new connections are automatically authenticated with the default user without any explicit <a href="https://redis.io/commands/auth"><code>AUTH</code></a> call needed.</p>

<blockquote>
<p>同时，默认用户的*nopass*规则意味着新的连接自动被默认用户认证，不需要显式的<a href="https://redis.io/commands/auth"><code>AUTH</code></a>调用。</p>
</blockquote>

<h2 id="acl-rules">ACL rules</h2>

<blockquote>
<p>ACL规则</p>
</blockquote>

<p>The following is the list of valid ACL rules. Certain rules are just single words that are used in order to activate or remove a flag, or to perform a given change to the user ACL. Other rules are char prefixes that are concatenated with command or category names, key patterns, and so forth.</p>

<blockquote>
<p>下面是有效的ACL规则列表。某些规则只是单个单词，用于激活或移除标记，或者执行给定的改变用户ACL。其他规则是命令或类别名称或key规则等等的字符串前缀的组合连接。</p>
</blockquote>

<p>Enable and disallow users:</p>

<ul>
<li><code>on</code>: Enable the user: it is possible to authenticate as this user.</li>
<li><code>off</code>: Disallow the user: it&rsquo;s no longer possible to authenticate with this user; however, previously authenticated connections will still work. Note that if the default user is flagged as <em>off</em>, new connections will start as not authenticated and will require the user to send <a href="https://redis.io/commands/auth"><code>AUTH</code></a> or <a href="https://redis.io/commands/hello"><code>HELLO</code></a> with the AUTH option in order to authenticate in some way, regardless of the default user configuration.</li>
</ul>

<p>Allow and disallow commands:
&gt; 允许和禁止命令:</p>

<ul>
<li><code>+&lt;command&gt;</code>: Add the command to the list of commands the user can call. Can be used with <code>|</code> for allowing subcommands (e.g &ldquo;+config|get&rdquo;).
&gt; <code>+&lt;command&gt;</code>:将命令添加到用户可以调用的命令列表中。可以使用<code>|</code>来允许子命令（例如<code>+config|get</code>）。</li>
<li><code>-&lt;command&gt;</code>: Remove the command to the list of commands the user can call. Starting Redis 7.0, it can be used with <code>|</code> for blocking subcommands (e.g &ldquo;-config|set&rdquo;).
&gt; <code>-&lt;command&gt;</code>:从用户可以调用的命令列表中移除命令。Redis 7.0以上，可以使用<code>|</code>来阻止子命令（例如<code>-config|set</code>）。</li>
<li><code>+@&lt;category&gt;</code>: Add all the commands in such category to be called by the user, with valid categories being like @admin, @set, @sortedset, &hellip; and so forth, see the full list by calling the <a href="https://redis.io/commands/acl-cat"><code>ACL CAT</code></a> command. The special category @all means all the commands, both the ones currently present in the server, and the ones that will be loaded in the future via modules.
&gt; <code>+@&lt;category&gt;</code>:将一整类的命令添加到用户调用的命令列表中，有效的类别是@admin，@set，@sortedset，&hellip;和这样的，可以通过调用<a href="https://redis.io/commands/acl-cat"><code>ACL CAT</code></a>命令来查看完整的列表。特殊的类别@all意味着所有的命令，包括当前在服务器中的和将来通过模块加载的命令。</li>
<li><code>-@&lt;category&gt;</code>: Like <code>+@&lt;category&gt;</code> but removes the commands from the list of commands the client can call.
&gt; <code>-@&lt;category&gt;</code>:从用户可以调用的命令列表中移除命令。</li>
<li><code>+&lt;command&gt;|first-arg</code>: Allow a specific first argument of an otherwise disabled command. It is only supported on commands with no sub-commands, and is not allowed as negative form like -SELECT|1, only additive starting with &ldquo;+&rdquo;. This feature is deprecated and may be removed in the future.
&gt; <code>+&lt;command&gt;|first-arg</code>: 允许指定第一个参数的命令，如果参数是其他值则禁用。只适用于没有子命令的命令，不支持如<code>-SELECT|1</code>这种格式的<code>-</code>禁用模式，只支持<code>+</code>增加模式。这个特性已经被废弃，可能在未来被移除。</li>
<li><code>allcommands</code>: Alias for +@all. Note that it implies the ability to execute all the future commands loaded via the modules system.
&gt; <code>allcommands</code>:<code>+@all</code>的别名。能够执行通过模块系统加载的所有命令。</li>
<li><code>nocommands</code>: Alias for -@all。
&gt; <code>nocommands</code>:<code>-@all</code>的别名。</li>
</ul>

<p>Allow and disallow certain keys and key permissions:
&gt; 允许和禁用指定key和key权限:</p>

<ul>
<li><code>~&lt;pattern&gt;</code>: Add a pattern of keys that can be mentioned as part of commands. For instance <code>~*</code> allows all the keys. The pattern is a glob-style pattern like the one of <a href="https://redis.io/commands/keys"><code>KEYS</code></a>. It is possible to specify multiple patterns.<br />
&gt; <code>~&lt;pattern&gt;</code>:增加命令可以使用的key的规则，如<code>~*</code>是允许所有key，这个规则和<code>KEYS</code>命令的规则一样，而且可以指定多个规则。</li>
<li><code>%R~&lt;pattern&gt;</code>: (Available in Redis 7.0 and later) Add the specified read key pattern. This behaves similar to the regular key pattern but only grants permission to read from keys that match the given pattern. See <a href="https://redis.io/docs/manual/security/acl/#key-permissions">key permissions</a> for more information.
&gt; <code>%R~&lt;pattern&gt;</code>: (Redis7.0后可用)增加指定的key规则读权限。这个行为类似于正常的key规则，但只允许读取给定规则的key。参见<a href="https://redis.io/docs/manual/security/acl/#key-permissions">key权限</a></li>
<li><code>%W~&lt;pattern&gt;</code>: (Available in Redis 7.0 and later) Add the specified write key pattern. This behaves similar to the regular key pattern but only grants permission to write to keys that match the given pattern. See <a href="https://redis.io/docs/manual/security/acl/#key-permissions">key permissions</a> for more information.
&gt; <code>%W~&lt;pattern&gt;</code>: (Redis7.0后可用)增加指定key规则的写权限。这个行为类似于正常的key规则，但只允许写入给定规则的key。参见<a href="https://redis.io/docs/manual/security/acl/#key-permissions">key权限</a></li>
<li><code>%RW~&lt;pattern&gt;</code>: (Available in Redis 7.0 and later) Alias for <code>~&lt;pattern&gt;</code>.
&gt; <code>%RW~&lt;pattern&gt;</code>: (Redis7.0后可用) <code>~&lt;pattern&gt;</code>的别名。</li>
<li><code>allkeys</code>: Alias for <code>~*</code>.
&gt; <code>allkeys</code>: <code>~*</code>的别名。</li>
<li><code>resetkeys</code>: Flush the list of allowed keys patterns. For instance the ACL <code>~foo:* ~bar:* resetkeys ~objects:*</code>, will only allow the client to access keys that match the pattern <code>objects:*</code>.
&gt; <code>resetkeys</code>:清除允许的key规则。如 <code>~foo:* ~bar:* resetkeys ~objects:*</code>为只允许客户端访问<code>object:*</code>规则的key。</li>
</ul>

<p>Allow and disallow Pub/Sub channels:
&gt; 允许和禁用 Pub/Sub channels：</p>

<ul>
<li><code>&amp;&lt;pattern&gt;</code>: (Available in Redis 6.2 and later) Add a glob style pattern of Pub/Sub channels that can be accessed by the user. It is possible to specify multiple channel patterns. Note that pattern matching is done only for channels mentioned by <a href="https://redis.io/commands/publish"><code>PUBLISH</code></a> and <a href="https://redis.io/commands/subscribe"><code>SUBSCRIBE</code></a>, whereas <a href="https://redis.io/commands/psubscribe"><code>PSUBSCRIBE</code></a> requires a literal match between its channel patterns and those allowed for user.
&gt; <code>&amp;&lt;pattern&gt;</code>: (Redis 6.2以后可用)，设置用户可访问的Pub/Sub频道的全局规则。可以指定多个频道规则。需要注意的是，模式匹配仅针对发布<code>PUBLISH</code>和订阅<code>SUBSCRIBE</code>提到的频道进行，而<code>PSUBSCRIBE</code>则需要在其频道模式和允许用户的频道模式之间进行字面匹配。</li>
<li><code>allchannels</code>: Alias for <code>&amp;*</code> that allows the user to access all Pub/Sub channels.
&gt; <code>allchannels</code>: <code>&amp;*</code> 的别名，允许用户访问所有的Pub/Sub频道。</li>
<li><code>resetchannels</code>: Flush the list of allowed channel patterns and disconnect the user&rsquo;s Pub/Sub clients if these are no longer able to access their respective channels and/or channel patterns.
&gt; <code>resetchannels</code>: 清空用户所有的频道允许列表并断开用户 Pub/Sub客户端链接，如果它们不再能够访问其各自的频道和/或频道规则。</li>
</ul>

<p>Configure valid passwords for the user:
&gt; 为用户设置密码</p>

<ul>
<li><code>&gt;&lt;password&gt;</code>: Add this password to the list of valid passwords for the user. For example <code>&gt;mypass</code> will add &ldquo;mypass&rdquo; to the list of valid passwords. This directive clears the <em>nopass</em> flag (see later). Every user can have any number of passwords.
&gt; <code>&gt;&lt;password&gt;</code>: 将这个密码添加到用户有效密码列表中。如<code>&gt;mypass</code>将把&rdquo;mypass&rdquo;添加到有效密码列表中。这个指令会清除 *nopass*标记。每个用户可以设置任意数量的密码。</li>
<li><code>&lt;&lt;password&gt;</code>: Remove this password from the list of valid passwords. Emits an error in case the password you are trying to remove is actually not set.
&gt; <code>&lt;&lt;password&gt;</code>: 从有效密码列表中一出这个密码。如果没设置给定密码时会报错。</li>
<li><code>#&lt;hash&gt;</code>: Add this SHA-256 hash value to the list of valid passwords for the user. This hash value will be compared to the hash of a password entered for an ACL user. This allows users to store hashes in the <code>acl.conf</code> file rather than storing cleartext passwords. Only SHA-256 hash values are accepted as the password hash must be 64 characters and only contain lowercase hexadecimal characters.
&gt; <code>#&lt;hash&gt;</code>：将这个 SHA-256的哈希值添加到用户有效密码列表中。这个哈希值将会与用户输入的密码的hash值进行比较。用户可以将hash值存储在<code>acl.conf</code>文件中，而不是存储明文密码。因为密码的hash为64个字符，并且只能包含小写的16进制字符，所以只支持 SHA-256的hash值。</li>
<li><code>!&lt;hash&gt;</code>: Remove this hash value from the list of valid passwords. This is useful when you do not know the password specified by the hash value but would like to remove the password from the user.
&gt; 从有效密码列表中删除这个hash值。当你不知道指定的hash值对应的密码，但是想要删除这个密码时可以使用这个指令。</li>
<li><code>nopass</code>: All the set passwords of the user are removed, and the user is flagged as requiring no password: it means that every password will work against this user. If this directive is used for the default user, every new connection will be immediately authenticated with the default user without any explicit AUTH command required. Note that the <em>resetpass</em> directive will clear this condition.
&gt; <code>nopass</code>：所有设置的密码都会被删除，并且用户会被标记为需要无密码：这意味着每个密码都可以用于这个用户。如果这个指令用于默认用户，每次连接都会自动认证为默认用户，不需要显式的AUTH命令。注意，*resetpass*指令会清除这个条件。</li>
<li><code>resetpass</code>: Flushes the list of allowed passwords and removes the <em>nopass</em> status. After <em>resetpass</em>, the user has no associated passwords and there is no way to authenticate without adding some password (or setting it as <em>nopass</em> later).
&gt; <code>resetpass</code>: 清空密码列表，并清除*nopass*状态，用户没有关联密码，且必须添加密码才能进行认证（除非设置为<em>nopass</em>)。</li>
</ul>

<p><em>Note: if a user is not flagged with nopass and has no list of valid passwords, that user is effectively impossible to use because there will be no way to log in as that user.</em></p>

<p><em>注意：如果用户没有标记为<code>nopass</code>并且没有有效密码列表，那么用户将无法使用，因为没有方法登录为这个用户。</em></p>

<p>Configure selectors for the user:
&gt; 为用户设置选择器：</p>

<ul>
<li><code>(&lt;rule list&gt;)</code>: (Available in Redis 7.0 and later) Create a new selector to match rules against. Selectors are evaluated after the user permissions, and are evaluated according to the order they are defined. If a command matches either the user permissions or any selector, it is allowed. See <a href="https://redis.io/docs/manual/security/acl/#selectors">selectors</a> for more information.</li>
</ul>

<blockquote>
<p><code>(&lt;rule list&gt;)</code>: (Redis7.0及以后可用) 创建一个新的规则匹配选择器。选择器根据用户的权限和权限的顺序进行运算。如果一个命令匹配了用户的权限或者任何选择器，那么它就是允许的。详细信息请参见<a href="https://redis.io/docs/manual/security/acl/#selectors">选择器</a>。</p>
</blockquote>

<ul>
<li><code>clearselectors</code>: (Available in Redis 7.0 and later) Delete all of the selectors attached to the user.
&gt; <code>clearselectors</code>: (Redis7.0及以后可用) 删除所有附加到用户的选择器。</li>
</ul>

<p>Reset the user:
&gt; 重置用户：</p>

<ul>
<li><code>reset</code> Performs the following actions: resetpass, resetkeys, resetchannels, off, -@all. The user returns to the same state it had immediately after its creation.
&gt; <code>reset</code> 执行以下操作：<code>resetpass</code>, <code>resetkeys</code>, <code>resetchannels</code>, <code>off</code>, <code>-@all</code>。用户会返回到它创建后的状态。</li>
</ul>

<h2 id="create-and-edit-user-acls-with-the-acl-setuser-command">Create and edit user ACLs with the ACL SETUSER command</h2>

<blockquote>
<p>使用ACL SETUSER命令创建和编辑用户ACLs。</p>
</blockquote>

<p>Users can be created and modified in two main ways:
&gt; 通过两种方式创建和编辑用户：</p>

<ol>
<li><p>Using the ACL command and its <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> subcommand.
&gt; 使用ACL命令和其<a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a>子命令。</p></li>

<li><p>Modifying the server configuration, where users can be defined, and restarting the server. With an <em>external ACL file</em>, just call <a href="https://redis.io/commands/acl-load"><code>ACL LOAD</code></a>.
&gt; 修改缓存服务中定义用户的配置并重启缓存服务。使用*外部ACL文件*，只需调用<a href="https://redis.io/commands/acl-load"><code>ACL LOAD</code></a>。</p></li>
</ol>

<p>In this section we&rsquo;ll learn how to define users using the <a href="https://redis.io/commands/acl"><code>ACL</code></a> command. With such knowledge, it will be trivial to do the same things via the configuration files. Defining users in the configuration deserves its own section and will be discussed later separately.
&gt; 在这一节我们来学习如何使用<a href="https://redis.io/commands/acl"><code>ACL</code></a> 命令来定义用户。懂了这个，通过配置文件来做同样的事情就很好弄了。在配置文件中定义用户在其他章节单独讨论。</p>

<p>To start, try the simplest <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> command call:
&gt; 开始，试试最简单的<a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a>命令调用：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL SETUSER alice
OK</code></pre></div>
<p>The <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> command takes the username and a list of ACL rules to apply to the user. However the above example did not specify any rule at all. This will just create the user if it did not exist, using the defaults for new users. If the user already exists, the command above will do nothing at all.
&gt;  <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> 命令会给用户赋予用户名和一套ACL鬼节列表。然而上面的例子并没有定义任何规则。执行后如果用户不存在会使用默认规则创建新用户。如果用户已经存在了，那命令不会做任何操作。</p>

<p>Check the default user status:
&gt; 检查默认用户状态：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL LIST
1) &#34;user alice off &amp;* -@all&#34;
2) &#34;user default on nopass ~* ~&amp; +@all&#34;</code></pre></div>
<p>The new user &ldquo;alice&rdquo; is:
&gt; 新用户&rdquo;alice&rdquo;：</p>

<ul>
<li>In the off status, so <a href="https://redis.io/commands/auth"><code>AUTH</code></a> will not work for the user &ldquo;alice&rdquo;.
&gt; 是关闭状态，所以用户&rdquo;alice&rdquo;不能使用<a href="https://redis.io/commands/auth"><code>AUTH</code></a>命令。</li>
<li>The user also has no passwords set.
&gt; 没设置密码。</li>
<li>Cannot access any command. Note that the user is created by default without the ability to access any command, so the <code>-@all</code> in the output above could be omitted; however, <a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a> attempts to be explicit rather than implicit.
&gt; 不能访问任何命令。注意，默认创建的用户是不能访问任何命令的，所以输出中的<code>-@all</code>可以省略；但是<a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a>会尽量都展示而不是给省略掉。</li>
<li>There are no key patterns that the user can access.
&gt; 没有用户可以访问的key规则。</li>
<li>The user can access all Pub/Sub channels.
&gt; 用户可以访问所有Pub/Sub频道。</li>
</ul>

<p>New users are created with restrictive permissions by default. Starting with Redis 6.2, ACL provides Pub/Sub channels access management as well. To ensure backward compatibility with version 6.0 when upgrading to Redis 6.2, new users are granted the &lsquo;allchannels&rsquo; permission by default. The default can be set to <code>resetchannels</code> via the <code>acl-pubsub-default</code> configuration directive.</p>

<blockquote>
<p>默认情况下新建的用户有限定的权限。Redis 6.2以后，ACL提供了Pub/Sub频道访问管理。为了确保6.0版本和6.2版本之间的兼容性，新建用户默认被赋予&rsquo;allchannels&rsquo;权限。可以通过配置<code>acl-pubsub-default</code>来设置默认值为<code>resetchannels</code>。</p>
</blockquote>

<p>From 7.0, The <code>acl-pubsub-default</code> value is set to <code>resetchannels</code> to restrict the channels access by default to provide better security. The default can be set to <code>allchannels</code> via the <code>acl-pubsub-default</code> configuration directive to be compatible with previous versions.</p>

<blockquote>
<p>从7.0版本开始，<code>acl-pubsub-default</code>值默认设置为<code>resetchannels</code>，以提供更好的安全性。可以通过配置<code>acl-pubsub-default</code>来设置默认值为<code>allchannels</code>，以兼容6.0版本。</p>
</blockquote>

<p>Such user is completely useless. Let&rsquo;s try to define the user so that it is active, has a password, and can access with only the <a href="https://redis.io/commands/get"><code>GET</code></a> command to key names starting with the string &ldquo;cached:&ldquo;.</p>

<blockquote>
<p>这样的用户是完全无用的。让我们来激活用户，给用户设置密码，并让用户只能使用<code>GET</code>命令访问以&rdquo;cached:&ldquo;开头的key。</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL SETUSER alice on &gt;p1pp0 ~cached:* +get
OK</code></pre></div>
<p>Now the user can do something, but will refuse to do other things:</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; AUTH alice p1pp0
OK
&gt; GET foo
(error) NOPERM this user has no permissions to access one of the keys used as arguments
&gt; GET cached:1234
(nil)
&gt; SET cached:1234 zap
(error) NOPERM this user has no permissions to run the &#39;set&#39; command</code></pre></div>
<p>Things are working as expected. In order to inspect the configuration of the user alice (remember that user names are case sensitive), it is possible to use an alternative to <a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a> which is designed to be more suitable for computers to read, while <a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a> is more human readable.</p>

<blockquote>
<p>可以使用<a href="https://redis.io/commands/acl-getuser"><code>ACL GETUSER</code></a>来查看用户alice的配置（记住，用户名是大小写敏感的）。</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL GETUSER alice
1) &#34;flags&#34;
2) 1) &#34;on&#34;
   2) &#34;allchannels&#34;
3) &#34;passwords&#34;
4) 1) &#34;2d9c75...&#34;
5) &#34;commands&#34;
6) &#34;-@all +get&#34;
7) &#34;keys&#34;
8) &#34;~cached:*&#34;
9) &#34;channels&#34;
10) &#34;&amp;*&#34;
11) &#34;selectors&#34;
12) 1) 1) &#34;commands&#34;
       2) &#34;-@all +set&#34;
       3) &#34;keys&#34;
       4) &#34;~*&#34;
       5) &#34;channels&#34;
       6) &#34;&amp;*&#34;</code></pre></div>
<p>The <a href="https://redis.io/commands/acl-getuser"><code>ACL GETUSER</code></a> returns a field-value array that describes the user in more parsable terms. The output includes the set of flags, a list of key patterns, passwords, and so forth. The output is probably more readable if we use RESP3, so that it is returned as a map reply:</p>

<blockquote>
<p><a href="https://redis.io/commands/acl-getuser"><code>ACL GETUSER</code></a> 命令返回分拆的用户字段数组。输出包含  <code>flags</code>集合、<code>key</code>规则列表、密码等等信息。输出以RESP3协议来说可读性更好，它返回的是一个map:</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL GETUSER alice
1# &#34;flags&#34; =&gt; 1~ &#34;on&#34;
   2~ &#34;allchannels&#34;
2# &#34;passwords&#34; =&gt; 1) &#34;2d9c75273d72b32df726fb545c8a4edc719f0a95a6fd993950b10c474ad9c927&#34;
3# &#34;commands&#34; =&gt; &#34;-@all +get&#34;
4# &#34;keys&#34; =&gt; &#34;~cached:*&#34;
5# &#34;channels&#34; =&gt; &#34;&amp;*&#34;
6# &#34;selectors&#34; =&gt; 1) 1# &#34;commands&#34; =&gt; &#34;-@all +set&#34;
    2# &#34;keys&#34; =&gt; &#34;~*&#34;
    3# &#34;channels&#34; =&gt; &#34;&amp;*&#34;</code></pre></div>
<p><em>Note: from now on, we&rsquo;ll continue using the Redis default protocol, version 2</em></p>

<p>Using another <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> command (from a different user, because alice cannot run the <a href="https://redis.io/commands/acl"><code>ACL</code></a> command), we can add multiple patterns to the user:</p>

<blockquote>
<p>用其他的用户使用<code>ACL SETUSER</code>命令，可以给<code>alice</code>用户配置其他key规则。</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL SETUSER alice ~objects:* ~items:* ~public:*
OK
&gt; ACL LIST
1) &#34;user alice on &gt;2d9c75... ~cached:* ~objects:* ~items:* ~public:* &amp;* -@all +get&#34;
2) &#34;user default on nopass ~* &amp;* +@all&#34;</code></pre></div>
<p>The user representation in memory is now as we expect it to be.
&gt; 效果和我们预期的一样。</p>

<h2 id="multiple-calls-to-acl-setuser">Multiple calls to ACL SETUSER</h2>

<p>It is very important to understand what happens when <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> is called multiple times. What is critical to know is that every <a href="https://redis.io/commands/acl-setuser"><code>ACL SETUSER</code></a> call will NOT reset the user, but will just apply the ACL rules to the existing user. The user is reset only if it was not known before. In that case, a brand new user is created with zeroed-ACLs. The user cannot do anything, is disallowed, has no passwords, and so forth. This is the best default for safety.
&gt; 理解<code>ACL SETUSER</code>命令被调用多次的运作原理很重要。尤其要知道，每次执行<code>ACL SETUSER</code> 命令并不会重置用户，只会将ACL规则应用到已有用户上。只有用户不存在才会被重置。那种情况，会创建一类无ACL权限用户。用户不能做任何事情，没有密码，禁用等等。是最安全的默认模式。</p>

<p>However later calls will just modify the user incrementally. For instance, the following sequence:
&gt; 后续的调用只会增量的修改用户信息。例如如下调用顺序：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL SETUSER myuser +set
OK
&gt; ACL SETUSER myuser +get
OK</code></pre></div>
<p>Will result in myuser being able to call both <a href="https://redis.io/commands/get"><code>GET</code></a> and <a href="https://redis.io/commands/set"><code>SET</code></a>:
&gt; <code>myuser</code>用户可以同时调用<code>GET</code>和<code>SET</code>命令。</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL LIST
1) &#34;user default on nopass ~* &amp;* +@all&#34;
2) &#34;user myuser off &amp;* -@all +set +get&#34;</code></pre></div>
<h2 id="command-categories">Command categories</h2>

<blockquote>
<p>命令分类</p>
</blockquote>

<p>Setting user ACLs by specifying all the commands one after the other is really annoying, so instead we do things like this:
&gt; 给用户的ACL权限</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL SETUSER antirez on +@all -@dangerous &gt;42a979... ~*</code></pre></div>
<p>By saying +@all and -@dangerous, we included all the commands and later removed all the commands that are tagged as dangerous inside the Redis command table. Note that command categories <strong>never include modules commands</strong> with the exception of +@all. If you say +@all, all the commands can be executed by the user, even future commands loaded via the modules system. However if you use the ACL rule +@read or any other, the modules commands are always excluded. This is very important because you should just trust the Redis internal command table. Modules may expose dangerous things and in the case of an ACL that is just additive, that is, in the form of <code>+@all -...</code> You should be absolutely sure that you&rsquo;ll never include what you did not mean to.
&gt; 通过提供<code>+@all</code> 和<code>-@dangerous</code>信息，我们加入了所有命令的权限，然后移除了Redis命令列表中带有<code>dangerours</code>标签的所有命令。需要注意命令分类是<strong>不包含模块命令的</strong>，除非使用<code>+@all</code>。如果你给了 <code>+@all</code>信息，用户就能执行所有命令，包括未来通过模块系统新加载的命令。然而，如果你使用 ACL规则 <code>+@read</code>或其他类似规则，那么模块系统命令通常是排除掉的。这非常重要，因为你应该只相信Redis的内部命令表。模块系统可能暴露危险的事情，尤其在通过使用 <code>+@all</code>的情况附加到ACL权限的情况。你应该绝对确保你没有引用你不需要的东西。</p>

<p>The following is a list of command categories and their meanings:
&gt; 下面是命令分类列表和他们的含义：</p>

<ul>
<li><p><strong>admin</strong> - Administrative commands. Normal applications will never need to use these. Includes <a href="https://redis.io/commands/replicaof"><code>REPLICAOF</code></a>, <a href="https://redis.io/commands/config"><code>CONFIG</code></a>, <a href="https://redis.io/commands/debug"><code>DEBUG</code></a>, <a href="https://redis.io/commands/save"><code>SAVE</code></a>, <a href="https://redis.io/commands/monitor"><code>MONITOR</code></a>, <a href="https://redis.io/commands/acl"><code>ACL</code></a>, <a href="https://redis.io/commands/shutdown"><code>SHUTDOWN</code></a>, etc.
&gt; <strong>admin</strong> - 管理员命令。通常应用不会用这些命令。包含<a href="https://redis.io/commands/replicaof"><code>REPLICAOF</code></a>, <a href="https://redis.io/commands/config"><code>CONFIG</code></a>, <a href="https://redis.io/commands/debug"><code>DEBUG</code></a>, <a href="https://redis.io/commands/save"><code>SAVE</code></a>, <a href="https://redis.io/commands/monitor"><code>MONITOR</code></a>, <a href="https://redis.io/commands/acl"><code>ACL</code></a>, <a href="https://redis.io/commands/shutdown"><code>SHUTDOWN</code></a>,等。</p></li>

<li><p><strong>bitmap</strong> - Data type: bitmaps related.
&gt; <strong>bitmap</strong> - bitmaps数据类型相关命令</p></li>

<li><p><strong>blocking</strong> - Potentially blocking the connection until released by another command.
&gt; <strong>blocking</strong> - 可能会阻塞连接直到另一个命令释放连接。</p></li>

<li><p><strong>connection</strong> - Commands affecting the connection or other connections. This includes <a href="https://redis.io/commands/auth"><code>AUTH</code></a>, <a href="https://redis.io/commands/select"><code>SELECT</code></a>, <a href="https://redis.io/commands/command"><code>COMMAND</code></a>, <a href="https://redis.io/commands/client"><code>CLIENT</code></a>, <a href="https://redis.io/commands/echo"><code>ECHO</code></a>, <a href="https://redis.io/commands/ping"><code>PING</code></a>, etc.
&gt; <strong>connection</strong> - 影响当前连接和其他连接的命令。包含 <a href="https://redis.io/commands/auth"><code>AUTH</code></a>, <a href="https://redis.io/commands/select"><code>SELECT</code></a>, <a href="https://redis.io/commands/command"><code>COMMAND</code></a>, <a href="https://redis.io/commands/client"><code>CLIENT</code></a>, <a href="https://redis.io/commands/echo"><code>ECHO</code></a>, <a href="https://redis.io/commands/ping"><code>PING</code></a>,等等。</p></li>

<li><p><strong>dangerous</strong> - Potentially dangerous commands (each should be considered with care for various reasons). This includes <a href="https://redis.io/commands/flushall"><code>FLUSHALL</code></a>, <a href="https://redis.io/commands/migrate"><code>MIGRATE</code></a>, <a href="https://redis.io/commands/restore"><code>RESTORE</code></a>, <a href="https://redis.io/commands/sort"><code>SORT</code></a>, <a href="https://redis.io/commands/keys"><code>KEYS</code></a>, <a href="https://redis.io/commands/client"><code>CLIENT</code></a>, <a href="https://redis.io/commands/debug"><code>DEBUG</code></a>, <a href="https://redis.io/commands/info"><code>INFO</code></a>, <a href="https://redis.io/commands/config"><code>CONFIG</code></a>, <a href="https://redis.io/commands/save"><code>SAVE</code></a>, <a href="https://redis.io/commands/replicaof"><code>REPLICAOF</code></a>, etc.
&gt; <strong>dangerous</strong> - 可能危险的命令（每个应该谨慎考虑使用）。包含 <a href="https://redis.io/commands/flushall"><code>FLUSHALL</code></a>, <a href="https://redis.io/commands/migrate"><code>MIGRATE</code></a>, <a href="https://redis.io/commands/restore"><code>RESTORE</code></a>, <a href="https://redis.io/commands/sort"><code>SORT</code></a>, <a href="https://redis.io/commands/keys"><code>KEYS</code></a>, <a href="https://redis.io/commands/client"><code>CLIENT</code></a>, <a href="https://redis.io/commands/debug"><code>DEBUG</code></a>, <a href="https://redis.io/commands/info"><code>INFO</code></a>, <a href="https://redis.io/commands/config"><code>CONFIG</code></a>, <a href="https://redis.io/commands/save"><code>SAVE</code></a>, <a href="https://redis.io/commands/replicaof"><code>REPLICAOF</code></a>,等等。</p></li>

<li><p><strong>geo</strong> - Data type: geospatial indexes related.
&gt; geo数据类型相关命令</p></li>

<li><p><strong>hash</strong> - Data type: hashes related.
&gt; <strong>hash</strong> - 哈希数据类型相关命令</p></li>

<li><p><strong>hyperloglog</strong> - Data type: hyperloglog related.
&gt; <strong>hyperloglog</strong> - hyperloglog数据类型相关命令</p></li>

<li><p><strong>fast</strong> - Fast O(1) commands. May loop on the number of arguments, but not the number of elements in the key.
&gt; <strong>fast</strong> - 快速O(1)命令。可能会遍历参数数量，但不会遍历键中的元素数量。</p></li>

<li><p><strong>keyspace</strong> - Writing or reading from keys, databases, or their metadata in a type agnostic way. Includes <a href="https://redis.io/commands/del"><code>DEL</code></a>, <a href="https://redis.io/commands/restore"><code>RESTORE</code></a>, <a href="https://redis.io/commands/dump"><code>DUMP</code></a>, <a href="https://redis.io/commands/rename"><code>RENAME</code></a>, <a href="https://redis.io/commands/exists"><code>EXISTS</code></a>, <a href="https://redis.io/commands/dbsize"><code>DBSIZE</code></a>, <a href="https://redis.io/commands/keys"><code>KEYS</code></a>, <a href="https://redis.io/commands/expire"><code>EXPIRE</code></a>, <a href="https://redis.io/commands/ttl"><code>TTL</code></a>, <a href="https://redis.io/commands/flushall"><code>FLUSHALL</code></a>, etc. Commands that may modify the keyspace, key, or metadata will also have the <code>write</code> category. Commands that only read the keyspace, key, or metadata will have the <code>read</code> category.
&gt; 以类型无关的方式读写键，数据库，或其元数据的命令类型。包含 <a href="https://redis.io/commands/del"><code>DEL</code></a>, <a href="https://redis.io/commands/restore"><code>RESTORE</code></a>, <a href="https://redis.io/commands/dump"><code>DUMP</code></a>, <a href="https://redis.io/commands/rename"><code>RENAME</code></a>, <a href="https://redis.io/commands/exists"><code>EXISTS</code></a>, <a href="https://redis.io/commands/dbsize"><code>DBSIZE</code></a>, <a href="https://redis.io/commands/keys"><code>KEYS</code></a>, <a href="https://redis.io/commands/expire"><code>EXPIRE</code></a>, <a href="https://redis.io/commands/ttl"><code>TTL</code></a>, <a href="https://redis.io/commands/flushall"><code>FLUSHALL</code></a>,等等。命令可能会修改键空间，键，或元数据的命令将有<code>write</code>类别。命令只能读取键空间，键，或元数据将有<code>read</code>类别。</p></li>

<li><p><strong>list</strong> - Data type: lists related.
&gt; <strong>list</strong> - list数据类型相关命令</p></li>

<li><p><strong>pubsub</strong> - PubSub-related commands.
&gt; <strong>pubsub</strong> - pubsub相关命令</p></li>

<li><p><strong>read</strong> - Reading from keys (values or metadata). Note that commands that don&rsquo;t interact with keys, will not have either <code>read</code> or <code>write</code>.
&gt; <strong>read</strong> - 读取键（值或元数据）。请注意，不会交互的命令将不会有<code>read</code>或<code>write</code>类别。</p></li>

<li><p><strong>scripting</strong> - Scripting related.
&gt; <strong>scripting</strong> - 脚本相关命令</p></li>

<li><p><strong>set</strong> - Data type: sets related.
&gt; <strong>set</strong> - set数据类型相关命令</p></li>

<li><p><strong>sortedset</strong> - Data type: sorted sets related.
&gt; <strong>sortedset</strong> - sortedset数据类型相关命令</p></li>

<li><p><strong>slow</strong> - All commands that are not <code>fast</code>.
&gt; <strong>slow</strong> - 非<code>fast</code>命令</p></li>

<li><p><strong>stream</strong> - Data type: streams related.
&gt; <strong>stream</strong> - stream数据类型相关命令</p></li>

<li><p><strong>string</strong> - Data type: strings related.
&gt; <strong>string</strong> - string数据类型相关命令</p></li>

<li><p><strong>transaction</strong> - <a href="https://redis.io/commands/watch"><code>WATCH</code></a> / <a href="https://redis.io/commands/multi"><code>MULTI</code></a> / <a href="https://redis.io/commands/exec"><code>EXEC</code></a> related commands.
&gt; <strong>transaction</strong> - <a href="https://redis.io/commands/watch"><code>WATCH</code></a> / <a href="https://redis.io/commands/multi"><code>MULTI</code></a> / <a href="https://redis.io/commands/exec"><code>EXEC</code></a>相关命令</p></li>

<li><p><strong>write</strong> - Writing to keys (values or metadata).
&gt; <strong>write</strong> - 写入键（值或元数据）的命令。</p></li>
</ul>

<p>Redis can also show you a list of all categories and the exact commands each category includes using the Redis <a href="https://redis.io/commands/acl"><code>ACL</code></a> command&rsquo;s <code>CAT</code> subcommand. It can be used in two forms:</p>

<blockquote>
<p>Redis可以查看分类列表及分类包含的命令列表，使用Redis <a href="https://redis.io/commands/acl"><code>ACL</code></a>命令的<code>CAT</code>子命令。它有两种用法：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">ACL CAT -- Will just list all the categories available
<span style="color:#8f5902;font-style:italic">## 可以查看所有的可用分类</span>
ACL CAT &lt;category-name&gt; -- Will list all the commands inside the category
<span style="color:#8f5902;font-style:italic">## 可以查看分类包含的所有的命令</span></code></pre></div>
<p>Examples:</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback"> &gt; ACL CAT
 1) &#34;keyspace&#34;
 2) &#34;read&#34;
 3) &#34;write&#34;
 4) &#34;set&#34;
 5) &#34;sortedset&#34;
 6) &#34;list&#34;
 7) &#34;hash&#34;
 8) &#34;string&#34;
 9) &#34;bitmap&#34;
10) &#34;hyperloglog&#34;
11) &#34;geo&#34;
12) &#34;stream&#34;
13) &#34;pubsub&#34;
14) &#34;admin&#34;
15) &#34;fast&#34;
16) &#34;slow&#34;
17) &#34;blocking&#34;
18) &#34;dangerous&#34;
19) &#34;connection&#34;
20) &#34;transaction&#34;
21) &#34;scripting&#34;</code></pre></div>
<p>As you can see, so far there are 21 distinct categories. Now let&rsquo;s check what command is part of the <em>geo</em> category:
&gt; 可以看到有21个不同分类，还可以看到*geo*分类下的命令：</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL CAT geo
1) &#34;geohash&#34;
2) &#34;georadius_ro&#34;
3) &#34;georadiusbymember&#34;
4) &#34;geopos&#34;
5) &#34;geoadd&#34;
6) &#34;georadiusbymember_ro&#34;
7) &#34;geodist&#34;
8) &#34;georadius&#34;</code></pre></div>
<p>Note that commands may be part of multiple categories. For example, an ACL rule like <code>+@geo -@read</code> will result in certain geo commands to be excluded because they are read-only commands.
&gt; 需要注意：一个命令可能同时属于多个分类。如：<code>+@geo -@read</code>将导致geo命令被排除，因为它们是只读命令。</p>

<h2 id="allow-block-subcommands">Allow/block subcommands</h2>

<blockquote>
<p>允许/拒绝子命令</p>
</blockquote>

<p><del>Starting from Redis 7.0, subcommands can be allowed/blocked just like other commands (by using the separator <code>|</code> between the command and subcommand, for example: <code>+config|get</code> or <code>-config|set</code>)</del></p>

<blockquote>
<p><del>Redis7.0之后，子命令可以被允许/拒绝，可以用<code>|</code>分隔命令和子命令，例如：<code>+config|get</code>或<code>-config|set</code></del></p>
</blockquote>

<p><del>That is true for all commands except DEBUG. In order to allow/block specific DEBUG subcommands, see the next section.</del>
   &gt; <del>除了<code>DEBUG</code>命令其他命令都适用。</del></p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-text" data-lang="text">本节使用删除线因为主要介绍Redis6.0特性。</code></pre></div>
<h2 id="allow-the-first-arg-of-a-blocked-command">Allow the first-arg of a blocked command</h2>

<p><strong>Note: This feature is deprecated since Redis 7.0 and may be removed in the future.</strong>
&gt; ** 注意：该特性已经被Redis7.0取消了，可能在未来会被删除。那我就不翻了**</p>

<p>Sometimes the ability to exclude or include a command or a subcommand as a whole is not enough. Many deployments may not be happy providing the ability to execute a <a href="https://redis.io/commands/select"><code>SELECT</code></a> for any DB, but may still want to be able to run <code>SELECT 0</code>.</p>

<p>In such case we could alter the ACL of a user in the following way:</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">ACL SETUSER myuser -select +select|0</code></pre></div>
<p>First, remove the <a href="https://redis.io/commands/select"><code>SELECT</code></a> command and then add the allowed first-arg. Note that <strong>it is not possible to do the reverse</strong> since first-args can be only added, not excluded. It is safer to specify all the first-args that are valid for some user since it is possible that new first-args may be added in the future.</p>

<p>Another example:</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">ACL SETUSER myuser -debug +debug|digest</code></pre></div>
<p>Note that first-arg matching may add some performance penalty; however, it is hard to measure even with synthetic benchmarks. The additional CPU cost is only paid when such commands are called, and not when other commands are called.</p>

<p>It is possible to use this mechanism in order to allow subcommands in Redis versions prior to 7.0 (see above section).</p>

<h2 id="all-vs-all">+@all VS -@all</h2>

<blockquote>
<p><code>+@all</code> VS <code>-@all</code></p>
</blockquote>

<p>In the previous section, it was observed how it is possible to define command ACLs based on adding/removing single commands.</p>

<blockquote>
<p>在上一节中，我们可以通过添加/删除单个命令来定义命令ACL。</p>
</blockquote>

<h2 id="selectors">Selectors</h2>

<blockquote>
<p>选择器</p>
</blockquote>

<p>Starting with Redis 7.0, Redis supports adding multiple sets of rules that are evaluated independently of each other. These secondary sets of permissions are called selectors and added by wrapping a set of rules within parentheses. In order to execute a command, either the root permissions (rules defined outside of parenthesis) or any of the selectors (rules defined inside parenthesis) must match the given command. Internally, the root permissions are checked first followed by selectors in the order they were added.</p>

<blockquote>
<p>Redis7.0之后，Redis支持添加多个独立的规则集，这些规则集可以被包裹在括号中，以便添加到命令ACL中。为了执行命令，括号外定义的规则的顶级权限或括号内定义的规则的选择器必须匹配给定命令。在内部，顶级权限会先检查，然后按照添加顺序依次检查选择器。</p>
</blockquote>

<p>For example, consider a user with the ACL rules <code>+GET ~key1 (+SET ~key2)</code>. This user is able to execute <code>GET key1</code> and <code>SET key2 hello</code>, but not <code>GET key2</code> or <code>SET key1 world</code>.</p>

<blockquote>
<p>例如，一个用户ACL规则为<code>+GET ~key1 (+SET ~key2)</code>。该用户可以执行<code>GET key1</code>和<code>SET key2 hello</code>，但不能执行<code>GET key2</code>或<code>SET key1 world</code>。</p>
</blockquote>

<p>Unlike the user&rsquo;s root permissions, selectors cannot be modified after they are added. Instead, selectors can be removed with the <code>clearselectors</code> keyword, which removes all of the added selectors. Note that <code>clearselectors</code> does not remove the root permissions.</p>

<blockquote>
<p>与用户的顶级权限不同，选择器在添加后无法改变。可以使用<code>clearselectors</code>关键字来删除所有添加的选择器，但不会删除顶级权限。</p>
</blockquote>

<h2 id="key-permissions">Key permissions</h2>

<blockquote>
<p>Key权限</p>
</blockquote>

<p>Starting with Redis 7.0, key patterns can also be used to define how a command is able to touch a key. This is achieved through rules that define key permissions. The key permission rules take the form of <code>%(&lt;permission&gt;)~&lt;pattern&gt;</code>. Permissions are defined as individual characters that map to the following key permissions:</p>

<blockquote>
<p>从Redis7.0版本开始，key规则也可以被用于定义命令能否访问一个Key。这是通过定义key权限的规则来实现的。key权限规则的格式为<code>%(&lt;permission&gt;)~&lt;pattern&gt;</code>。权限是定义为单个字符的，映射到以下key权限：</p>
</blockquote>

<ul>
<li>W (Write): The data stored within the key may be updated or deleted.
&gt; 写（W）：key中存储的数据可以被更新或删除。</li>
<li>R (Read): User supplied data from the key is processed, copied or returned. Note that this does not include metadata such as size information (example <a href="https://redis.io/commands/strlen"><code>STRLEN</code></a>), type information (example <a href="https://redis.io/commands/type"><code>TYPE</code></a>) or information about whether a value exists within a collection (example <a href="https://redis.io/commands/sismember"><code>SISMEMBER</code></a>).
&gt; 读（R）：用户提供的数据从key中被处理，复制或返回。注意，这不包括元数据，例如size信息（例如<a href="https://redis.io/commands/strlen"><code>STRLEN</code></a>)，类型信息（例如<a href="https://redis.io/commands/type"><code>TYPE</code></a>)）或是否存在于集合中（例如<a href="https://redis.io/commands/sismember"><code>SISMEMBER</code></a>)）。</li>
</ul>

<p>Permissions can be composed together by specifying multiple characters. Specifying the permission as &lsquo;RW&rsquo; is considered full access and is analogous to just passing in <code>~&lt;pattern&gt;</code>.</p>

<blockquote>
<p>权限可以通过指定多个字符组合来组合。指定权限为“RW”被认为是完全访问，并且类似于只传入<code>~&lt;pattern&gt;</code>。</p>
</blockquote>

<p>For a concrete example, consider a user with ACL rules <code>+@all ~app1:* (+@readonly ~app2:*)</code>. This user has full access on <code>app1:*</code> and readonly access on <code>app2:*</code>. However, some commands support reading data from one key, doing some transformation, and storing it into another key. One such command is the <a href="https://redis.io/commands/copy"><code>COPY</code></a> command, which copies the data from the source key into the destination key. The example set of ACL rules is unable to handle a request copying data from <code>app2:user</code> into <code>app1:user</code>, since neither the root permission or the selector fully matches the command. However, using key selectors you can define a set of ACL rules that can handle this request <code>+@all ~app1:* %R~app2:*</code>. The first pattern is able to match <code>app1:user</code> and the second pattern is able to match <code>app2:user</code>.</p>

<blockquote>
<p>举一个具体的例子，假设一个用户ACL规则为<code>+@all ~app1:* (+@readonly ~app2:*)</code>。该用户具有完全访问<code>app1:*</code>和只读访问<code>app2:*</code>。然而，有些命令支持从一个key中读取数据，进行一些转换，并将其存储到另一个key中。例如<a href="https://redis.io/commands/copy"><code>COPY</code></a>命令，它可以复制数据从源key到目标key。该例子的ACL规则无法处理一个请求从<code>app2:user</code>复制数据到<code>app1:user</code>，因为顶级权限或选择器不能完全匹配命令。但是，使用key选择器，你可以定义一组ACL规则，以处理这个请求<code>+@all ~app1:* %R~app2:*</code>。第一个规则可以匹配<code>app1:user</code>，第二个规则可以匹配<code>app2:user</code>。</p>
</blockquote>

<p>Which type of permission is required for a command is documented through <a href="https://redis.io/topics/key-specs#logical-operation-flags">key specifications</a>. The type of permission is based off the keys logical operation flags. The insert, update, and delete flags map to the write key permission. The access flag maps to the read key permission. If the key has no logical operation flags, such as <a href="https://redis.io/commands/exists"><code>EXISTS</code></a>, the user still needs either key read or key write permissions to execute the command.</p>

<blockquote>
<p>命令必备哪种类型的权限归档在<a href="https://redis.io/topics/key-specs#logical-operation-flags">key说明</a>。权限的类型取决于key的逻辑操作标志。插入，更新，删除标志映射到写入key权限。访问标志映射到读取key权限。如果key没有逻辑操作标志，例如<a href="https://redis.io/commands/exists"><code>EXISTS</code></a>，用户仍然需要key读或key写权限才能执行命令。</p>
</blockquote>

<p>Note: Side channels to accessing user data are ignored when it comes to evaluating whether read permissions are required to execute a command. This means that some write commands that return metadata about the modified key only require write permission on the key to execute: For example, consider the following two commands:</p>

<blockquote>
<p>注意：当评估执行命令是否需要读权限时，侧信道访问用户数据被忽略。这意味着一些会返回被修改键的元信息的修改命令只需要key的写权限去执行：作为案例，我们看看一下两个命令：</p>
</blockquote>

<ul>
<li><code>LPUSH key1 data</code>: modifies &ldquo;key1&rdquo; but only returns metadata about it, the size of the list after the push, so the command only requires write permission on &ldquo;key1&rdquo; to execute.
&gt; <code>LPUSH key1 data</code>：修改“key1”，但只返回元信息，列表push元素以后集合的大小，所以命令只需要&rdquo;key1&rdquo;的写权限去执行。</li>
<li><code>LPOP key2</code>: modifies &ldquo;key2&rdquo; but also returns data from it, the left most item in the list, so the command requires both read and write permission on &ldquo;key2&rdquo; to execute.
&gt; <code>LPOP key2</code>：修改“key2”，同时返回数据，列表最左边的项，所以命令需要读取和写入&rdquo;key2&rdquo;权限去执行。</li>
</ul>

<p>If an application needs to make sure no data is accessed from a key, including side channels, it&rsquo;s recommended to not provide any access to the key.</p>

<blockquote>
<p>如果一个应用需要确保通过key不能访问数据，包括侧信道，那么建议不要提供任何访问key的权限。</p>
</blockquote>

<h2 id="how-passwords-are-stored-internally">How passwords are stored internally</h2>

<blockquote>
<p>密码的内部存储方式</p>
</blockquote>

<p>Redis internally stores passwords hashed with SHA256. If you set a password and check the output of <a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a> or <a href="https://redis.io/commands/acl-getuser"><code>ACL GETUSER</code></a>, you&rsquo;ll see a long hex string that looks pseudo random. Here is an example, because in the previous examples, for the sake of brevity, the long hex string was trimmed:</p>

<blockquote>
<p>密码的内部存储方式是SHA256哈希。如果设置密码，并且检查<a href="https://redis.io/commands/acl-list"><code>ACL LIST</code></a>或<a href="https://redis.io/commands/acl-getuser"><code>ACL GETUSER</code></a>的输出，你会看到一个长的十六进制字符串，它看起来像是伪随机的。现在举一个例子，因为在上一个例子中了简化展示我们只显示了长哈希前面的部分。</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL GETUSER default
1) &#34;flags&#34;
2) 1) &#34;on&#34;
   2) &#34;allkeys&#34;
   3) &#34;allcommands&#34;
   4) &#34;allchannels&#34;
3) &#34;passwords&#34;
4) 1) &#34;2d9c75273d72b32df726fb545c8a4edc719f0a95a6fd993950b10c474ad9c927&#34;
5) &#34;commands&#34;
6) &#34;+@all&#34;
7) &#34;keys&#34;
8) &#34;~*&#34;
9) &#34;channels&#34;
10) &#34;&amp;*&#34;
11) &#34;selectors&#34;
12) (empty array)</code></pre></div>
<p>Also, starting with Redis 6, the old command <code>CONFIG GET requirepass</code> will no longer return the clear text password, but instead the hashed password.</p>

<blockquote>
<p>同时，从Redis 6开始，旧的命令<code>CONFIG GET requirepass</code>将不再返回明文密码，而是返回哈希密码。</p>
</blockquote>

<p>Using SHA256 provides the ability to avoid storing the password in clear text while still allowing for a very fast <a href="https://redis.io/commands/auth"><code>AUTH</code></a> command, which is a very important feature of Redis and is coherent with what clients expect from Redis.</p>

<blockquote>
<p>使用SHA256可以避免明文存储密码，同时还允许快速的<a href="https://redis.io/commands/auth"><code>AUTH</code></a>命令，这是Redis的一个重要特性，并且与客户端的期望一致。</p>
</blockquote>

<p>However ACL <em>passwords</em> are not really passwords. They are shared secrets between the server and the client, because the password is not an authentication token used by a human being. For instance:</p>

<blockquote>
<p>但ACL *密码*不是真正的密码。它们是服务器和客户端之间的共享密钥，因为密码不是一个人类可以使用的认证令牌。例如：</p>
</blockquote>

<ul>
<li>There are no length limits, the password will just be memorized in some client software. There is no human that needs to recall a password in this context.
&gt; 没有长度限制，密码将只被记忆在某些客户端软件中。在这种情况下不需要人工调用密码。</li>
<li>The ACL password does not protect any other thing. For example, it will never be the password for some email account.
&gt; ACL密码不用于保障其他东西。例如，它不会是某个邮箱账户的密码。</li>
<li>Often when you are able to access the hashed password itself, by having full access to the Redis commands of a given server, or corrupting the system itself, you already have access to what the password is protecting: the Redis instance stability and the data it contains.
&gt; 当你已经可以有访问指定服务器命令的全部权限时，可以有权限访问哈希密码，或者破坏系统本身，则你已经有权限访问密码所保护的东西了：Redis实例的稳定性和它包含的数据。</li>
</ul>

<p>For this reason, slowing down the password authentication, in order to use an algorithm that uses time and space to make password cracking hard, is a very poor choice. What we suggest instead is to generate strong passwords, so that nobody will be able to crack it using a dictionary or a brute force attack even if they have the hash. To do so, there is a special ACL command <a href="https://redis.io/commands/acl-genpass"><code>ACL GENPASS</code></a> that generates passwords using the system cryptographic pseudorandom generator:</p>

<blockquote>
<p>因此，为了使用算法和空间来是密码破解更困难而降低密码认证的速度，不是很好的选择。我们建议生成强密码，这样就不会有人能够使用字典或者爆破攻击，即使他们有哈希的认证令牌。为此，有一个特殊的ACL命令<a href="https://redis.io/commands/acl-genpass"><code>ACL GENPASS</code></a>，可以使用系统加密随机数生成器生成密码：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">&gt; ACL GENPASS
&#34;dd721260bfe1b3d9601e7fbab36de6d04e2e67b0ef1c53de59d45950db0dd3cc&#34;</code></pre></div>
<p>The command outputs a 32-byte (256-bit) pseudorandom string converted to a 64-byte alphanumerical string. This is long enough to avoid attacks and short enough to be easy to manage, cut &amp; paste, store, and so forth. This is what you should use in order to generate Redis passwords.</p>

<blockquote>
<p>这个命令输出一个32字节（256位）的随机字符串转换为64字节的字母数字字符串。这是长到足够防止攻击且短到能够管理、剪切、粘贴、等等。这是你应该使用的生成Redis密码的方式。</p>
</blockquote>

<h2 id="use-an-external-acl-file">Use an external ACL file</h2>

<blockquote>
<p>使用外部ACL文件</p>
</blockquote>

<p>There are two ways to store users inside the Redis configuration:
&gt; Redis配置存储用户信息有两种方式</p>

<ol>
<li>Users can be specified directly inside the <code>redis.conf</code> file.
&gt; 可以直接定义到<code>redis.conf</code>文件中</li>
<li>It is possible to specify an external ACL file.
&gt; 可以指定一个外部ACL文件</li>
</ol>

<p>The two methods are <em>mutually incompatible</em>, so Redis will ask you to use one or the other. Specifying users inside <code>redis.conf</code> is good for simple use cases. When there are multiple users to define, in a complex environment, we recommend you use the ACL file instead.</p>

<blockquote>
<p>两种方式是*互不兼容*的，因此Redis会让你二选一。对于简单的使用场景，可以把用户定义到 <code>redis.conf</code>配置中。当需要定义多个用户时，在复杂的环境中，我们推荐使用外部ACL文件。</p>
</blockquote>

<p>The format used inside <code>redis.conf</code> and in the external ACL file is exactly the same, so it is trivial to switch from one to the other, and is the following:</p>

<blockquote>
<p><code>redis.conf</code>和外部ACL文件的格式是相同的，因此可以互相切换，格式如下：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">user &lt;username&gt; ... acl rules ...</code></pre></div>
<p>For instance:</p>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">user worker +@list +@connection ~jobs:* on &gt;ffa9203c493aa99</code></pre></div>
<p>When you want to use an external ACL file, you are required to specify the configuration directive called <code>aclfile</code>, like this:</p>

<blockquote>
<p>当你使用外部ACL文件时，你必须指定配置参数<code>aclfile</code>，格式如下：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">aclfile /etc/redis/users.acl</code></pre></div>
<p>When you are just specifying a few users directly inside the <code>redis.conf</code> file, you can use <a href="https://redis.io/commands/config-rewrite"><code>CONFIG REWRITE</code></a> in order to store the new user configuration inside the file by rewriting it.</p>

<blockquote>
<p>如果只是在<code>redis.conf</code>文件中定义几个用户，可以使用<code>CONFIG REWRITE</code>命令来将新的用户配置重写存储到文件中。</p>
</blockquote>

<p>The external ACL file however is more powerful. You can do the following:
&gt; 外部ACL文件的功能更强大。你可以做到以下事情：</p>

<ul>
<li><p>Use <a href="https://redis.io/commands/acl-load"><code>ACL LOAD</code></a> if you modified the ACL file manually and you want Redis to reload the new configuration. Note that this command is able to load the file <em>only if all the users are correctly specified</em>. Otherwise, an error is reported to the user, and the old configuration will remain valid.
&gt; 如果你手动修改了ACL配置文件，可以使用<code>ACL LOAD</code> 命令让Redis重新加载新配置。注意，这个命令只能加载正确的配置文件，*只有所有用户都正确定义了*。否则会报错，然后恢复旧配置。</p></li>

<li><p>Use <a href="https://redis.io/commands/acl-save"><code>ACL SAVE</code></a> to save the current ACL configuration to the ACL file.
&gt; 如果你想要保存当前ACL配置到ACL文件，可以使用<code>ACL SAVE</code>命令。</p></li>
</ul>

<p>Note that <a href="https://redis.io/commands/config-rewrite"><code>CONFIG REWRITE</code></a> does not also trigger <a href="https://redis.io/commands/acl-save"><code>ACL SAVE</code></a>. When you use an ACL file, the configuration and the ACLs are handled separately.</p>

<blockquote>
<p>注意，<code>CONFIG REWRITE</code>命令不会触发<code>ACL SAVE</code>命令。当你使用一个ACL文件时，配置和ACL都是分开处理的。</p>
</blockquote>

<h2 id="acl-rules-for-sentinel-and-replicas">ACL rules for Sentinel and Replicas</h2>

<blockquote>
<p>Sentinel 和 Replica 的ACL规则</p>
</blockquote>

<p>In case you don&rsquo;t want to provide Redis replicas and Redis Sentinel instances full access to your Redis instances, the following is the set of commands that must be allowed in order for everything to work correctly.</p>

<blockquote>
<p>如果你不想让Redis Replica和Redis Sentinel实例具有完全的访问权限，为了让功能正常运行，下面的命令集合就必须给予权限。</p>
</blockquote>

<p>For Sentinel, allow the user to access the following commands both in the master and replica instances:</p>

<blockquote>
<p>对于Sentinel , 允许用户在主实例和从实例中访问以下命令：</p>
</blockquote>

<ul>
<li>AUTH, CLIENT, SUBSCRIBE, SCRIPT, PUBLISH, PING, INFO, MULTI, SLAVEOF, CONFIG, CLIENT, EXEC.</li>
</ul>

<p>Sentinel does not need to access any key in the database but does use Pub/Sub, so the ACL rule would be the following (note: <a href="https://redis.io/commands/auth"><code>AUTH</code></a> is not needed since it is always allowed):</p>

<blockquote>
<p>Sentinel 不需要访问任何键，但是需要访问Pub/Sub，因此ACL规则是（注意：<a href="https://redis.io/commands/auth"><code>AUTH</code></a>不需要，因为它总是允许的）：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-shell" data-lang="shell">ACL SETUSER sentinel-user on &gt;somepassword allchannels +multi +slaveof +ping +exec +subscribe +config<span style="color:#000;font-weight:bold">|</span>rewrite +role +publish +info +client<span style="color:#000;font-weight:bold">|</span>setname +client<span style="color:#000;font-weight:bold">|</span><span style="color:#204a87">kill</span> +script<span style="color:#000;font-weight:bold">|</span>kill</code></pre></div>
<p>Redis replicas require the following commands to be allowed on the master instance:</p>

<blockquote>
<p>Redis副本需要在主实例上允许以下命令：</p>
</blockquote>

<ul>
<li>PSYNC, REPLCONF, PING</li>
</ul>

<p>No keys need to be accessed, so this translates to the following rules:</p>

<blockquote>
<p>没有键需要访问，因此这个规则转换为：</p>
</blockquote>
<div class="highlight"><pre style="background-color:#f8f8f8;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-fallback" data-lang="fallback">ACL setuser replica-user on &gt;somepassword +psync +replconf +ping</code></pre></div>
<p>Note that you don&rsquo;t need to configure the replicas to allow the master to be able to execute any set of commands. The master is always authenticated as the root user from the point of view of replicas.</p>

<blockquote>
<p>注意，你不需要配置副本来允许主实例执行任何命令。主实例总是从实例认证为的根用户。</p>
</blockquote>

    </div>
    <footer class="post-footer">
     

     <div class="post-nav">
    <div class="post-nav-next post-nav-item">
    
        <a href="http://www.shutdown.cn/post/redis6.0%E6%96%B0%E7%89%B9%E6%80%A7-acls%E6%9D%83%E9%99%90%E6%8E%A7%E5%88%B6/" rel="next" title="">
        <i class="fa fa-chevron-left"></i> 
        </a>
    
    </div>

    <div class="post-nav-prev post-nav-item">
    
        <a href="http://www.shutdown.cn/post/redis6.0%E6%96%B0%E7%89%B9%E6%80%A7-acl%E6%9D%83%E9%99%90%E6%8E%A7%E5%88%B6%E5%85%B6%E4%BA%8C/" rel="prev" title="">
         <i class="fa fa-chevron-right"></i>
        </a>
    
    </div>
</div>
      
     
     
     






    </footer>
  </article>
</section>

          </div>
        </div>
        <div class="sidebar-toggle">
  <div class="sidebar-toggle-line-wrap">
    <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
    <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
    <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
  </div>
</div>
<aside id="sidebar" class="sidebar">
  <div class="sidebar-inner">

    <section class="site-overview sidebar-panel  sidebar-panel-active ">
      <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image"
        src="http://www.shutdown.cn/img/author.jpg"
        alt="不与天斗Domino" />
    <p class="site-author-name" itemprop="name">不与天斗Domino</p>
    <p class="site-description motion-element" itemprop="description"> 
        Programmer &amp; Architect</p>
</div>
      <nav class="site-state motion-element">
    <div class="site-state-item site-state-posts">
      <a href="http://www.shutdown.cn/post/">
        <span class="site-state-item-count">183</span>
        <span class="site-state-item-name">日志</span>
      </a>
    </div>
    <div class="site-state-item site-state-categories">    
        <a href="http://www.shutdown.cn/categories/">      
         
        <span class="site-state-item-count">15</span>
        
        <span class="site-state-item-name">分类</span>
        
        </a>
    </div>

    <div class="site-state-item site-state-tags">
        <a href="http://www.shutdown.cn/tags/">
         
        <span class="site-state-item-count">224</span>
        
        <span class="site-state-item-name">标签</span>
        </a>
    </div>
</nav>
      
      

      

      <div class="links-of-blogroll motion-element inline">
<script type="text/javascript" src="//rf.revolvermaps.com/0/0/8.js?i=&amp;m=0&amp;s=220&amp;c=ff0000&amp;cr1=ffffff&amp;f=arial&amp;l=33&amp;bv=35" async="async"></script>
</div>

    </section>
    
  </div>
</aside>

      </div>
    </main>
   
    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright" >
  <span itemprop="copyrightYear">  &copy; 
  2013 - 2023</span>
  <span class="with-love"><i class="fa fa-heart"></i></span>
  <span class="author" itemprop="copyrightHolder">天地维杰网</span>
  <span class="icp" itemprop="copyrightHolder"><a href="https://beian.miit.gov.cn/" target="_blank">京ICP备13019191号-1</a></span>
</div>
<div class="powered-by">
  Powered by - <a class="theme-link" href="http://gohugo.io" target="_blank" title="hugo" >Hugo v0.63.2</a>
</div>
<div class="theme-info">
  Theme by - <a class="theme-link" href="https://github.com/xtfly/hugo-theme-next" target="_blank"> NexT
  </a>
</div>


      </div>
    </footer>

    <div class="back-to-top">
      <i class="fa fa-arrow-up"></i>
      <span id="scrollpercent"><span>0</span>%</span>
    </div>
  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/jquery/index.js?v=2.1.3"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/fastclick/lib/fastclick.min.js?v=1.0.6"></script> 
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/velocity/velocity.min.js?v=1.2.1"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/vendor/velocity/velocity.ui.min.js?v=1.2.1"></script>
<script src="http://www.shutdown.cn/js/vendor/ua-parser-js/dist/ua-parser.min.js?v=0.7.9"></script>

<script src="http://www.shutdown.cn/js/vendor/fancybox/jquery.fancybox.pack.js?v=2.1.5"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/utils.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/motion.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/affix.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/schemes/pisces.js"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/scrollspy.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/post-details.js"></script>
<script type="text/javascript" src="http://www.shutdown.cn/js/toc.js"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/bootstrap.js"></script>

<script type="text/javascript" src="http://www.shutdown.cn/js/search.js"></script>
<script type="text/x-mathjax-config">
  MathJax.Hub.Config({
    extensions: ["tex2jax.js"],
    jax: ["input/TeX", "output/HTML-CSS"],
    tex2jax: {
      inlineMath: [ ['$','$'] ],
      displayMath: [ ['$$','$$'] ],
      processEscapes: true
    },
    "HTML-CSS": { fonts: ["TeX"] }
  });
</script>
<script src='https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.5/MathJax.js?config=TeX-AMS-MML_HTMLorMML' async></script>
</body>
</html>